#!/bin/bash
#description: install and configure ldap 2.4.44 on centos7.4
#author: louis
PORT="eth1"
IP=$(ifconfig eth1|grep inet|awk 'NR==1{print $2}')
DOMAIN="test.com"
PASSWD="Aa123456"

function init(){
	#配置epel源
	cd /etc/yum.repos.d/
	[ ! -f epel.repo ] && yum -y install https://mirrors.aliyun.com/epel/epel-release-latest-7.noarch.rpm
	#安装软件
	yum -y install net-tools gcc gcc-c++ autoconf make tree vim wget openssh-clients ntpdate &>/dev/null
	#关闭防火墙
	systemctl disable firewalld
	systemctl stop firewalld
	sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
	setenforce 0
	#配置时间同步
	/sbin/ntpdate time1.aliyun.com
	#配置hosts
	echo "$IP $DOMAIN" >>/etc/hosts
}

function install_ldap(){
	#安装依赖
	yum -y install openssl openssl-devel nscd nss-* pcre pcre-* nss-pam-ldapd
	#通过yum的方式安装ldap
	yum -y install openldap compat-openldap openldap-clients openldap-servers openldap-servers-sql openldap-devel migrationtools
}

function configure_ldap(){
	#设置OpenLDAP的管理员密码
         /sbin/slappasswd -s Aa123456 -n > /etc/openldap/passwd
	#修改olcDatabase={2}hdb.ldif文件
	cd /etc/openldap/slapd.d/cn\=config/  && cp olcDatabase\=\{2\}hdb.ldif{,.ori_$(date +%F)}
	slappasswd -s $PASSWD|sed -e "s#{SSHA}#olcRootPW: {SSHA}#g" >> olcDatabase\=\{2\}hdb.ldif
	#修改域名信息
	sed -i "/olcSuffix/s//#&/g" olcDatabase\=\{2\}hdb.ldif
	sed -i "/olcRootDN/s//#&/g" olcDatabase\=\{2\}hdb.ldif
	sed -i "7a olcSuffix: dc=$(echo ${DOMAIN}|cut -d. -f1),dc=$( echo ${DOMAIN}|cut -d. -f2)" olcDatabase\=\{2\}hdb.ldif
	sed -i "8a olcRootDN: cn=root,dc=$(echo ${DOMAIN}|cut -d. -f1),dc=$( echo ${DOMAIN}|cut -d. -f2)" olcDatabase\=\{2\}hdb.ldif
	
	# 修改olcDatabase={1}monitor.ldif文件
	cd /etc/openldap/slapd.d/cn\=config/ && cp olcDatabase\=\{1\}monitor.ldif{,.ori_$(date +%F)}
	sed -i "/olcAccess/s//#&/g" olcDatabase\=\{1\}monitor.ldif
	sed -i "5a olcAccess: {0}to * by dn.base=\"gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\" read by dn.base=\"cn=root,dc=$(echo ${DOMAIN}|cut -d. -f1),dc=$( echo ${DOMAIN}|cut -d. -f2)\" read by * none" olcDatabase\=\{1\}monitor.ldif
        #验证OpenLDAP
	slaptest -u &>/dev/null
	if [ $? -eq 0 ];then
		echo "config file testing succeeded"
		systemctl enable slapd
		systemctl start slapd
	else
		echo "config file testing fail"
		exit 5
	fi
}
function configure_ldap_db(){
	cd /var/lib/ldap/ && [ ! -f DB_CONFIG ] && cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
	chown ldap:ldap -R /var/lib/ldap
	chmod -R 700 /var/lib/ldap
	#导入基本的schema
	ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
	ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
	ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif 
	#修改migrate_common.ph
	#migrate_common.ph文件主要是用于生成ldif文件使用
	cd /usr/share/migrationtools && cp migrate_common.ph{,.ori_$(date +%F)}
	sed -i "/^\$DEFAULT_MAIL_DOMAIN/s//#&/g" migrate_common.ph 
	sed -i "71a \$DEFAULT_MAIL_DOMAIN = \"${DOMAIN}\";" migrate_common.ph
	sed -i "/^\$DEFAULT_BASE/s//#&/g" migrate_common.ph
        sed -i "74a \$DEFAULT_BASE = \"dc=$(echo ${DOMAIN}|cut -d. -f1),dc=$( echo ${DOMAIN}|cut -d. -f2)\";" migrate_common.ph
	sed -i "s/\$EXTENDED_SCHEMA = 0;/\$EXTENDED_SCHEMA = 1;/g" migrate_common.ph
}

function install_PhpLDAPAdmin(){
	yum -y install phpldapadmin
	#配置
	cd /etc/httpd/conf.d/ && cp phpldapadmin.conf{,.ori_$(date +%F)}
        sed -i "/Require local/a  Require all granted" phpldapadmin.conf
	cd /etc/phpldapadmin/ && cp config.php{,.ori_$(date +%F)}
        sed -i "/\$servers->setValue('login','attr','uid');/d" config.php
        sed -i "398a \$servers->setValue('login','attr','dn');" config.php
	#启动http服务
	systemctl enable httpd
	systemctl start httpd
	#导入root用户到openldap
	cat >/tmp/user.ldif <<EOF
dn: dc=test,dc=com
o: test com
dc: test
objectclass: top
objectclass: dcObject
objectclass: organization

dn: cn=root,dc=test,dc=com
cn: root
objectclass: organizationalRole
description: Directory manager
EOF
	ldapadd -x -w "$PASSWD" -D "cn=root,dc=test,dc=com" -W -f /tmp/user.ldif 
}
                                

function main(){
	init
	install_ldap
        configure_ldap
	configure_ldap_db
	install_PhpLDAPAdmin
}
main		



